PMAT-1098: the release's bashrs gate runs on every PR — it stopped the 0.67.0 train three times on findings no PR check saw (#3196) - #3199
Merged
Conversation
…e 0.67.0 train three times on findings no PR check saw (#3196) dogfood.sh's bashrs row is the only place the SEC/DET/IDEM filter ran, so a PR could add a finding freely and the train paid for it at the pre-publish gate: 17:33Z (#3115, #3127 -> fixed by #3188), 20:58Z (#3187 -> #3194), 22:48Z (#3068 -> #3198). Three fixes round the merge queue while the tag waited. scripts/check_bashrs_gate.sh is that gate lifted out where the finding is cheap: same surface enumeration (git ls-files, N+1 receipt asserted), same positive control (a DET002 sentinel that must fire or the run is ENV/2), same code filter. Its --self-test carries a drift gate that greps dogfood.sh for the identical rule tuples, a classifier case table, a must-RED fixture repo built from the incident's exact construct (a --repo argument parsed into a variable and used in a subshell cd; cd "$1" alone is not flagged, measured), its must-GREEN twin carrying #3198's validation, and a vacuity case (gitignored script -> exit 2, named). Measured on real trees: main @ 0b6f94c -> exit 1, names cuda_rust_fleet_check.sh:129 DET002 and :201 SEC010; #3198's tree -> exit 0. 3 s over 294 files. Wired as a step of guard-cargo, which gate already requires. dogfood.sh is untouched in this change; consolidating its inline row onto this script is the follow-up named in #3196. Pmat-Ticket: PMAT-1098 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Author
|
Proofs repeated on the fleet's pinned bashrs 7.0.1 (
Still draft until #3198 merges; the gate is RED on main by construction until then. |
|
§13.11 rung 1 — quorum shadow verdict Shadow mode: this records a verdict and merges nothing. A refusal |
noahgift
marked this pull request as ready for review
September 13, 2026 07:09
noahgift
enabled auto-merge
September 13, 2026 07:09
check_roadmap_diff_additive.sh reported base id(s) missing at head: this branch forked before they landed on main, and a plain update takes one side of the file whole. Resolved as main's roadmap plus this branch's own new entries, each at its sorted slot among same-prefix peers. The other three roadmap guards pass on the result. Pmat-Ticket: PMAT-1098 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft until #3198 merges: main currently carries the two findings #3198 fixes, so this gate is RED on main by construction (that is the proof it discriminates), and a queue build before #3198 would fail on them.
The pre-publish dogfood's
bashrsrow stopped the 0.67.0 train three times in one day, each time on findings a PR had merged and nothing checked:scripts/check_bashrs_gate.shis the same gate, on the PR: samegit ls-filessurface with theLinted N+1receipt asserted, same DET002 positive control (silent tool = exit 2, never a pass), same SEC/DET/IDEM code filter with the bashrs#226 SC10xx class suppressed. Wired as one step ofguard-cargo, whichgatealready requires. 3 s over 294 files.Proofs
--self-test: drift gate (grepsdogfood.shfor the identical rule tuples), classifier case table, a must-RED fixture repo built from the incident's exact construct (--repoparsed into a variable, subshellcd;cd "$1"alone is not flagged, measured), its must-GREEN twin with PMAT-1098: the release gate went red a third time — #3068's fleet check carried a DET002 and a SEC010 that no PR check ran #3198's validation, and a gitignored-script vacuity case → exit 2.cuda_rust_fleet_check.sh:129 DET002and:201 SEC010; PMAT-1098: the release gate went red a third time — #3068's fleet check carried a DET002 and a SEC010 that no PR check ran #3198's tree → exit 0.dogfood.shis untouched here; consolidating its inline row onto this script is the follow-up in #3196.Refs #3196, #3198, PMAT-1098.
🤖 Generated with Claude Code